Riskcovery

CVE-2021-47198

scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine

State
Published
Severity
Not scored
Published
Apr 10, 2024
Updated
May 11, 2026
Reserved
Mar 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine

An error is detected with the following report when unloading the driver: "KASAN: use-after-free in lpfc_unreg_rpi+0x1b1b"

The NLP_REG_LOGIN_SEND nlp_flag is set in lpfc_reg_fab_ctrl_node(), but the flag is not cleared upon completion of the login.

This allows a second call to lpfc_unreg_rpi() to proceed with nlp_rpi set to LPFC_RPI_ALLOW_ERROR. This results in a use after free access when used as an rpi_ids array index.

Fix by clearing the NLP_REG_LOGIN_SEND nlp_flag in lpfc_mbx_cmpl_fc_reg_login().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fe83e3b9b422ac8ece2359c7b7290efe7f0335a2 to before dbebf865b3239595c1d4dba063b122862583b52aAffected
  • fe83e3b9b422ac8ece2359c7b7290efe7f0335a2 to before 79b20beccea3a3938a8500acef4e6b9d7c66142fAffected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 5.15.5 through 5.15.*Not affected
  • 5.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.